Systems are Debian Squeeze and Ubuntu Precise with identical configurations. Version of libpam-ldap is 184-8.5 on both distros.
Everything works fine with the following configuration in
host 10.220.100.11 base ou=companies,ou=asp,ou=sweden,dc=domain,dc=inet ldap_version 3 ssl on tls_checkpeer no binddn svc_unix_auth bindpw secret scope sub timelimit 30 pam_filter objectclass=User nss_map_attribute uid sAMAccountName pam_login_attribute sAMAccountName pam_password crypt pam_groupdn CN=Linux_Authentication,OU=Groups,OU=ourcompany,OU=Companies,OU=ASP,OU=sweden,DC=domain,DC=inet
Only one change to the pam configuration, in
auth [success=2 default=ignore] pam_unix.so nullok_secure auth [success=1 default=ignore] pam_ldap.so use_first_pass
The second line is what was added to enable ldap logins.
As soon as we remove
tls_checkpeer no from the file
/etc/pam_ldap.conf it fails because the LDAP server has a self-signed certificate.
Tried exporting the root CA certificate in base64 format from the LDAP server and putting it in /etc/ssl/certs with 0644 permissions. Then adding
tls_cacertfile /etc/ssl/certs/ldap_server.crt in
pam_ldap.conf but this is not helping.
How can I use the root CA and avoid disabling the check for self-signed certificates?